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Claim Rejections - 35 USC § 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

2. Claims 1-4, 9, 1 1-15, 20, 22-26, 31, and 33-35 are rejected under 35 
U.S.C. 102(e) as being anticipated by Schwartz (US 2003/0037063). 

As per claims 1, 12, 23, and 34-35, Schwartz teaches a system for generating 
risk assessment regarding software implementation projects comprising (paragraph 24: 
"the invention is directed to a network based method and system for risk assessment, 
risk monitoring and caseload management" whereby the exact field that the invention is 
used for is not a limitation as risk assessment is applicable across a range of fields.): 
access a specified importance value and maximum score for each risk factor 
(paragraph 96: "Decision block 417 represents a process where an initially assessed 
risk score is compared to a maximum acceptable value. If the assessed risk score 
does not exceed the acceptable value, no unacceptable risk is present and the system 
returns to standby mode (process 404). If the initial score is indicative of unacceptable 
risk (high risk), process 428 is performed to determine and store an initial "goal." The 
initial goal may be determined by a worker or generated automatically by system 
software 324."), the importance of each risk factor reflecting experience of an 
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implementing entity regarding the extent to which the risk factor may negatively impact 
a software implementation project if the risk factor is not adequately addressed 
(paragraph 53: "based on weighting variables defined by experts in the field." Whereby 
the expert would understand the importance and would reflect the experience of the 
potential negative impact if the factor was not considered), the importance value and 
maximum score for each factor is multiplied to define a weighted score for each factor 
(paragraph 74: "a risk assessment application calculates an initial risk assessment 
score." Whereby this calculation represents the calculation of a score for the risk 
factor); receive an actual score for each factor based on an analysis by the 
implementing entity specific to the particular software project (paragraph 97: "Logs may 
include risk scores associated with the clients, flags indicating high risk, goals, and 
other data such as detailed information about the primary client and associated 
secondary clients." Whereby an actual score is calculated for each factor.); generate 
an actual weighted score for each risk factor by multiplying the importance value and 
the actual score for the risk factor (paragraph 26: "Another aspect of the present 
invention is to provide a method of risk assessment where relative weights of risk 
assessment variables are determined and refined to produce accurate assessments."); 
determine a relationship between the potential weighted score and the actual weighted 
score for each factor (paragraph 93: "Process 401 represents a step that may be 
included to initiate a risk assessment application when using ANN or AFLRA based 
applications. Input-output data sets of known risk assessment input and expected 
output are first obtained. This "historical' 1 data is then stored in database 304 during 
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process 402. The historical data set is used to train the ANN or AFLRA software in 
process 403 using error backpropagation or other training algorithms known to those 
skilled in the art. Of course, it is to be understood that steps 401-403 are not always 
necessary if a fuzzy logic expert system is used alone as the risk assessment 
application in the present invention." Whereby the algorithm relates between the 
historical or potential data and the actual data); assign a risk level for the particular 
project to each risk factor according to the relationship between the potential weighted 
score and the actual weighted score for the risk factor, the risk level for each factor 
representing an assessment by the implementing entity regarding the extent to which 
the factor is not adequately addressed (paragraph 101: "When a dangerously high-risk 
level is assessed for a primary client, system 300 may suggest other means of 
notification" whereby a flag may be generated as noted in paragraph 90 to indicate the 
level was exceeded.); and generate a risk assessment for the project comprising one 
or more of the assigned risk levels for the project for one or more corresponding risk 
factors (paragraph 101: "When a high-risk assessment is generated by system 300" 
whereby an assessment is conducted with respect to a risk level.). 

As per claims 2, 13 and 24, Schwartz teaches the components generate a risk 
assessment scorecard for display which provides risk factors and the importance 
value, maximum score, potential weighted score, actual score, actual weighted score 
and risk level for each factor in a spreadsheet format (paragraph 84: "Each listing 508 
may comprise a URL, which when selected, causes server 302 to download and 
display on the worker computer 310 the selected primary client's detailed information 
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stored in database 304." Whereby the detailed information would comprise the various 
score values.)- 

As per claims 3, 14 and 25, Schwartz teaches the maximum score is the same 
for each risk factor; and the importance value and maximum score for a risk factor 
remain constant across multiple projects (paragraph 96: "Decision block 417 
represents a process where an initially assessed risk score is compared to a maximum 
acceptable value. If the assessed risk score does not exceed the acceptable value, no 
unacceptable risk is present and the system returns to standby mode (process 404). If 
the initial score is indicative of unacceptable risk (high risk), process 428 is performed 
to determine and store an initial "goal." The initial goal may be determined by a worker 
or generated automatically by system software 324." Whereby the worker may 
generate the maximum score allowed and may keep them all the same value.). 

As per claims 4, 15 and 26, Schwartz teaches the risk factor is associated with 
one of a plurality of risk factor categories, each risk factor category comprising one or 
more risk factors (paragraph 46: "include several risk categories for which the present 
invention can be used." And paragraph 59: "input variables representing risk factors"). 

As per claims 9, 20 and 31 , Schwartz teaches the actual score for a risk factor is 
determined by the implementing entity and is based on an evaluation of client 
resources and capabilities relevant to the risk factor (paragraph 53: "Risk assessment 
is a complex process where decisions leading to a risk assessment score are made 
based on weighting variables defined by experts in the field. A composite risk score is 
reached by combining weighted contributions of these variables. Whether a variable is 
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particularly relevant, or should be minimized, is usually left to the judgement of an 
expert in the particular field of risk being assessed. Additionally, variables under 
consideration when assessing risk, by their nature, are often imprecise or uncertain in 
the classical first order logic and classical probability theory sense. Because the 
number of relevant variables and determination of particular weights assigned to them 
present a formidable task for a system designer, known systems often produce scores 
that fail to adequately represent risk." Whereby the implementing entity (or seller) 
would be an expert and able to assign weights to lead to the calculation of the actual 
risk score.). 

As per claims 1 1 , 22 and 33, Schwartz teaches the assigned risk level is selected 
from the group consisting of high, medium and low (paragraph 104: "Furthermore, 
while a composite risk score is discussed above as being associated with a "level," it is 
to be understood that a level may be associated with a value within a range of values 
that define a particular classification category of risk, such as "low risk," "mid risk," or 
"high risk," for example."). 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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4. Claims 5, 8, 10, 16, 19, 21, 27, 30 and 32 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Schwartz. 

As per claims 5, 16 and 27, Schwartz teaches the components are collectively 
operable to generate a risk assessment for each risk factor category according to a 
category percentage risk for each risk factor category, the category percentage risk 
being determined by (paragraph 46): determining a quotient of a category actual score 
and a category maximum score (paragraph 50: "Variable values are then processed by 
a computer risk assessment application in the system to determine a composite risk 
score that indicates a level of risk present at the time the values were determined."), the 
category actual score reflecting the sum of the actual scores of all risk factors within a 
risk factor category, the category maximum score reflecting the sum of the maximum 
scores of all risk factors within a risk factor category; determining the quotient by 
dividing the category actual score by the category maximum score; and determining the 
category percentage risk by multiplying the quotient by one hundred (Official notice is 
taken that both the concept and advantage of mathematical manipulation are well 
known and expected in the art. Therefore, it would have been obvious to one of ordinary 
skill in the art at the time of the invention to manipulate the data by adding, dividing and 
multiplying combinations of data to facilitate the analysis of the information.). 

As per claims 8, 19 and 30, Schwartz teaches the implementing entity is a seller 
of software to be implemented in the particular software implementation project at one 
or more sites of a client (paragraph 75: "Preferably, the risk assessment application is 
accessible by, or part of an overall system application that performs risk assessment, 
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monitors risk, and assists workers in the field in managing primary client risk, thus 
forming a risk assessment, risk monitor, and case management system. This system 
application may be implemented by software on a computer. The risk assessment 
application of the present invention may be implemented with a software application or 
hardware that resides in the computer. Other data processing, data storage, and data 
retrieval of the system may be performed using the system software stored in the 
computer. The computer may be a server connected to a network with other devices 
capable running an Internet browser or other software that can be used to send, receive 
and display Web page information. These devices may include personal computers, 
portable computer devices, such as handheld or laptop computers, electronic paper, 
video monitors, audio systems, and wireless devices, such as wireless phones and PDA 
(Personal Data Assistant) devices. Other devices known to those skilled in the art are 
intended to be in the scope of the present invention." Official notice is taken that both 
the concept and advantage of having the seller install the software is well known and 
expected in the art. The software that is on the system would need to be installed by a 
person initially and it is known and common that the company that makes the software 
would send a sales representative to the site to install the software and set up the 
licenses on multiple site locations. Therefore is would have been obvious to one of 
ordinary skill in the art at the time of the invention to have used the seller to install the 
software to provide a more efficient means for initial set up of the system). 

As per claims 10, 21 and 32, Schwartz teaches the relationship between the 
potential weighted score and the actual weighted score for each risk factor (paragraph 



Application/Control Number: 09/992,283 Page 9 

Art Unit: 3623 

93: "Process 401 represents a step that may be included to initiate a risk assessment 
application when using ANN or AFLRA based applications. Input-output data sets of 
known risk assessment input and expected output are first obtained. This "historical" 
data is then stored in database 304 during process 402. The historical data set is used 
to train the ANN or AFLRA software in process 403 using error backpropagation or 
other training algorithms known to those skilled in the art. Of course, it is to be 
understood that steps 401-403 are not always necessary if a fuzzy logic expert system 
is used alone as the risk assessment application in the present invention." Whereby the 
algorithm relates between the historical or potential data and the actual data), 
determining assignment of the risk level for the risk factor (paragraph 101: "When a 
dangerously high-risk level is assessed for a primary client, system 300 may suggest 
other means of notification" whereby a flag may be generated as noted in paragraph 90 
to indicate the level was exceeded.), is a percentage based on one minus the quotient 
of the actual weighted score and the potential weighted score for each risk factor 
(Official notice is taken that both the concept and advantage of calculating a risk factor 
utilizing the formula mentioned is well known and expected in the art. Therefore it would 
have been obvious to one of ordinary skill in the art at the time of the invention to 
calculate a risk factor this way to provide a means for weighting the risk and thus 
providing a more accurate score.). 

5. Claims 6-7, 17-18 and 28-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Schwartz in view of Barton et al (US 2002/0059093). 
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As per claims 6, 17 and 28, Schwartz does not explicitly teach the components 
are collectively operable to generate a risk factor category scorecard for display. Baron 
teaches that it is well known to generate a risk factor scorecard for display (See Figure 
17: scorecard), the category scorecard providing the risk factor categories and the 
category actual score, category maximum score, and category percentage risk for each 
risk factor category (See Figure 17 which contains percentages and categories with 
maximum scores under the "infrastructure" and "routine & controls" headings.). Baron is 
an analogous art in that it also teaches about identifying and prioritizing risks. Therefore, 
it would have been obvious to one of ordinary skill in the art at the time of the invention 
to modify the risk assessment system of Schwartz with the scorecard feature of Barton 
to provide a more efficient means of displaying the risk factor information. 

As per claims 7, 18 and 29, Schwartz does not explicitly teach a spider chart for 
display. Baron teaches that it is well known to have components that collectively 
generate a risk factor category spider chart for display, the chart comprising a polygon 
with a number of sides equal to the number of risk factor categories, each pair of sides 
meeting at a vertex, a ray to each vertex, reflecting a range of category percentage risks 
for a corresponding risk factor category, a data point on a particular ray reflecting the 
category percentage risk for the corresponding risk factor category (See Figure 16: The 
risks are listed with their respective data point scores as well as total RPN scores for 
each category. Official notice is taken that the concept and advantage of calculating a 
percentage value for the risks is well known in the art, as noted by those calculated in 
Figure 17. Therefore it would have been obvious to one of ordinary skill in the art to 
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calculate a risk percentage based upon the category values.). Baron is an analogous art 
in that it also teaches about identifying and prioritizing risks. Therefore, it would have 
been obvious to one of ordinary skill in the art at the time of the invention to modify the 
risk assessment system of Schwartz with the chart feature of Barton to provide a more 
efficient means of displaying the risk factor information. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. The following art also teaches about risk assessment: Karmali 
(US 2002/0147676), "Identifying software project risks: An international Delphi study" by 
Roy Schmidt et al, Journal of Management Information, Spring 2001, vol 17, issue 4; 
"Software Metrics: Roadmap" by Norman Fenton et al, Future of Software Engineering, 
Limerick, Ireland, Copyright 2000. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Linda Krisciunas whose telephone number is 571-272- 
6931 . The examiner can normally be reached on Monday through Friday, 6:30 am to 
3:00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tariq Hafiz can be reached on 571-272-6729. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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